← All changes
|
includes/forms/class-charitable-forgot-password-form.php
+28
-19
1.6.8
→
1.8.13
View file →
| @@ -2,16 +2,18 @@ | ||
| 2 | 2 | /** |
| 3 | 3 | * Class that manages the display and processing of the forgot password form. |
| 4 | 4 | * |
| 5 | 5 | * @package Charitable/Classes/Charitable_Forgot_Password_Form |
| 6 | - * @author Rafe Colton, Eric Daams | |
| 7 | - * @copyright Copyright (c) 2019, Studio 164a | |
| 6 | + * @author Rafe Colton, David Bisset | |
| 7 | + * @copyright Copyright (c) 2023, WP Charitable LLC | |
| 8 | 8 | * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License |
| 9 | 9 | * @since 1.4.0 |
| 10 | 10 | * @version 1.5.1 |
| 11 | 11 | */ |
| 12 | 12 | |
| 13 | -if ( ! defined( 'ABSPATH' ) ) { exit; } | |
| 13 | +if ( ! defined( 'ABSPATH' ) ) { | |
| 14 | + exit; | |
| 15 | +} | |
| 14 | 16 | |
| 15 | 17 | if ( ! class_exists( 'Charitable_Forgot_Password_Form' ) ) : |
| 16 | 18 | |
| 17 | 19 | /** |
| @@ -51,10 +53,8 @@ | ||
| 51 | 53 | /** |
| 52 | 54 | * Create class object. |
| 53 | 55 | * |
| 54 | 56 | * @since 1.4.0 |
| 55 | - * | |
| 56 | - * @param array $args User-defined shortcode attributes. | |
| 57 | 57 | */ |
| 58 | 58 | public function __construct() { |
| 59 | 59 | $this->id = uniqid(); |
| 60 | 60 | |
| @@ -69,16 +69,19 @@ | ||
| 69 | 69 | * |
| 70 | 70 | * @return array |
| 71 | 71 | */ |
| 72 | 72 | public function get_fields() { |
| 73 | - $fields = apply_filters( 'charitable_forgot_password_fields', array( | |
| 74 | - 'user_login' => array( | |
| 75 | - 'label' => __( 'Email Address', 'charitable' ), | |
| 76 | - 'type' => 'email', | |
| 77 | - 'required' => true, | |
| 78 | - 'priority' => 10, | |
| 79 | - ), | |
| 80 | - ) ); | |
| 73 | + $fields = apply_filters( | |
| 74 | + 'charitable_forgot_password_fields', | |
| 75 | + array( | |
| 76 | + 'user_login' => array( | |
| 77 | + 'label' => __( 'Email Address', 'charitable' ), | |
| 78 | + 'type' => 'email', | |
| 79 | + 'required' => true, | |
| 80 | + 'priority' => 10, | |
| 81 | + ), | |
| 82 | + ) | |
| 83 | + ); | |
| 81 | 84 | |
| 82 | 85 | uasort( $fields, 'charitable_priority_sort' ); |
| 83 | 86 | |
| 84 | 87 | return $fields; |
| @@ -94,22 +97,28 @@ | ||
| 94 | 97 | public static function retrieve_password() { |
| 95 | 98 | $form = new Charitable_Forgot_Password_Form(); |
| 96 | 99 | |
| 97 | 100 | if ( ! $form->validate_nonce() || ! $form->validate_honeypot() ) { |
| 98 | - charitable_get_notices()->add_error( __( 'There was an error with processing your form submission. Please reload the page and try again.', 'charitable' ) ); | |
| 101 | + charitable_get_notices()->add_error( __( 'Unfortunately, we were unable to verify your form submission. Please reload the page and try again.', 'charitable' ) ); | |
| 99 | 102 | return; |
| 100 | 103 | } |
| 101 | 104 | |
| 102 | - if ( empty( $_POST['user_login'] ) ) { | |
| 105 | + if ( empty( $_POST['user_login'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 103 | 106 | charitable_get_notices()->add_error( __( '<strong>ERROR</strong>: Enter a username or email address.', 'charitable' ) ); |
| 104 | 107 | return; |
| 105 | - } elseif ( strpos( $_POST['user_login'], '@' ) ) { | |
| 106 | - $user = get_user_by( 'email', trim( $_POST['user_login'] ) ); | |
| 108 | + } | |
| 109 | + | |
| 110 | + /* Sanitize and unslash the user input. */ | |
| 111 | + $user_login = sanitize_text_field( wp_unslash( $_POST['user_login'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 112 | + | |
| 113 | + if ( strpos( $user_login, '@' ) ) { | |
| 114 | + $user = get_user_by( 'email', trim( $user_login ) ); | |
| 107 | 115 | } else { |
| 108 | - $login = trim( $_POST['user_login'] ); | |
| 109 | - $user = get_user_by( 'login', $login ); | |
| 116 | + $login = trim( $user_login ); | |
| 117 | + $user = get_user_by( 'login', $login ); | |
| 110 | 118 | } |
| 111 | 119 | |
| 120 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- lostpassword_post is a WordPress core hook for password reset functionality. | |
| 112 | 121 | do_action( 'lostpassword_post' ); |
| 113 | 122 | |
| 114 | 123 | /* If we are missing user data, proceed no further. */ |
| 115 | 124 | if ( ! $user ) { |